PT-2022-18474 · WordPress · The Ketchup Restaurant Reservations

Bastijn Ouwendijk · Published 2022-09-19 · Updated 2022-09-21 · CVE-2022-2754

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Ketchup Restaurant Reservations WordPress plugin version 1.0.0

Description The issue is related to the lack of validation and escaping of some reservation parameters before using them in SQL statements. This could allow unauthenticated attackers to perform SQL Injection attacks.

Recommendations For version 1.0.0, consider updating to a newer version that addresses this issue, as the current version does not properly validate and escape reservation parameters, making it susceptible to SQL Injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-2754

Affected Products

The Ketchup Restaurant Reservations

References · 5

• 🔥 https://wpscan.com/vulnerability/e3c6d137-ff6e-432a-a21a-b36dc81f73c5 · Exploit
• https://osv.dev/vulnerability/CVE-2022-2754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2754 · Security Note
• https://t.me/cibsecurity/50030 · Telegram Post
• https://t.me/cvenotify/36433 · Telegram Post